topic Re: Firewall intercepts Virus between networks. False Positive??? in General Topics

Firewall intercepts Virus between networks. False Positive???

Indorama_Ventures — Thu, 31 May 2018 08:46:09 GMT

Dear Palo Alto experts...,

We have various systems in our LAN seperated by our Palo Alto firewall.

In the last 24 hours the firewall detected 2.7K times the virus "Virus/Win32.WGeneric.rktkq"

The systems are scanned for inventory by two programs. Spiceworks and PDQ inventory. The scan server is on one side of the firewall. The other servers are on the other side of the firewall.

The "Spiceworks" server has been scanned by our Kasperksy AntiVirus solution. No detections here.

What could be causing this? And if it is a false positive, what would the next path forward to solve this problem?

Any thoughts you might have are very welcome.

Remko

Re: Firewall intercepts Virus between networks. False Positive???

kiwi — Thu, 31 May 2018 09:16:41 GMT

Hi @Indorama_Ventures,

Configure the firewall to gather a PCAP for the threat. Then you can send the PCAP to TAC for analysis.

If it's a false positive then likely a content update will fix it.

Cheers,

-Kiwi.

Re: Firewall intercepts Virus between networks. False Positive???

Indorama_Ventures — Thu, 31 May 2018 09:25:16 GMT

Thanks... My apologies for being a bit blond here.. Bit of a newbie I guess. 🙂

How would I go about sending the PCAP to TAC for analysis.

Never done this. Have no idea were to go and where to begin.

Re: Firewall intercepts Virus between networks. False Positive???

Indorama_Ventures — Thu, 31 May 2018 09:33:22 GMT

I may have found something

https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-Enable-Packet-Captures-on-Security-Profiles/ta-p/56449

Re: Firewall intercepts Virus between networks. False Positive???

kiwi — Thu, 31 May 2018 09:34:02 GMT

Hi @Indorama_Ventures,

Enable packet capture in your Antivirus threat profile :

This setting will create a PCAP that you can download for analysis on the Monitor > Threat log page.

Cheers !

-Kiwi.

Re: Firewall intercepts Virus between networks. False Positive???

Indorama_Ventures — Thu, 31 May 2018 09:53:06 GMT

I got my self a PCAP file. Thanks for pointing me in the right direction.

Now need to find where to upload it for analysis.

Not been able to find this yet.

I noticed I can also exclude this particular finding but perhaps better to wait for the verdict of Palo Alto

Re: Firewall intercepts Virus between networks. False Positive???

kiwi — Thu, 31 May 2018 11:18:26 GMT

Hi @Indorama_Ventures,

For PCAP analysis, you can create a support case and upload the file to the case.

Cheers !

-Kiwi.

Re: Firewall intercepts Virus between networks. False Positive???

Indorama_Ventures — Thu, 31 May 2018 11:28:10 GMT

Thanks, it appears I need to go through a local reseller in the Netherlands. I cannot create a case directly. This is cumbersome for just submitting a sample.

Thanks for helping me out here. Much appreciated!

Remko

Re: Firewall intercepts Virus between networks. False Positive???

Remo — Thu, 31 May 2018 12:14:38 GMT

Hi @Indorama_Ventures

Do you have a wildfire subscription? In yes, you could upload the proplematic executable (as it looks like in your logs the virus is detected the smb transfer of this executable) to wildfire as it will maybe show malicious (this signature was initially created by wildfire). Then you could report an incorrect verdict there without the need to create a case at your reseller.

But the "best" is probably still if you create a case at your reseller (and ask for premium support at next renewal so you will be able to create cases directly 😉

Regards,

Remo

Re: Firewall intercepts Virus between networks. False Positive???

Indorama_Ventures — Thu, 31 May 2018 12:22:52 GMT

Yes we do.

The file (PDQInventoryScanner.exe) as shown in the screenshot is classified as benign. So not sure why it is triggered.

In the screenshot it also shows certain URL's as the same virus.

Most likely the inventory scanner also checks cloud services for things like warrenty, etc.

I just do not understand why I have all of a sudden 2.7 K of virusses detected 🙂

I have submitted a case now with the local reseller.

Will keep you posted...

Re: Firewall intercepts Virus between networks. False Positive???

Remo — Thu, 31 May 2018 12:32:05 GMT

Since when exactly do you have these in the logs? The signature was initially released by wildfire on 2018-05-21 and in normal threat updates on 2018-05-22. So depending when you have installed these updates, you probably have these alerts in the log since then... if this scanner runs continuously to do something.

Re: Firewall intercepts Virus between networks. False Positive???

Indorama_Ventures — Thu, 31 May 2018 12:52:07 GMT

I started noticing these warnings yesterday. Prior to this, this particular "virus" was not found.

The report runs at night for the last 24 hours.

Yesterday the count was 1973.

For today (last 24 hours ) the count is 2040

It is hard to tell when exactly a scan is triggered. When the scan is > 7 days old. When a new application is installed a scanned is performed, etc.

Strange thing is that is also triggers on URL's

I am not sure why I am seeing these messages?

Re: Firewall intercepts Virus between networks. False Positive???

Remo — Thu, 31 May 2018 13:53:20 GMT

Hi @Indorama_Ventures

Make sure that you also add a packet capture of one of these logs (SMB traffic with an URL as filename) to the case. This either is a very special attack in your network or - probably more likely - a bug.

Re: Firewall intercepts Virus between networks. False Positive???

Leo_Dittemore — Wed, 06 Jun 2018 19:53:57 GMT

We also have this very same problem. Also running PDQ Inventory and Spiceworks. Do we need to upload a packet capture too?

Leo

Re: Firewall intercepts Virus between networks. False Positive???

Indorama_Ventures — Thu, 07 Jun 2018 06:19:02 GMT

I do not believe you do. This is the latest reply from Palo Alto

we've had a wave of few days last month where our static analysis caused a number of false positives due to an artifact that wasn't such a sure indicator of compromise yet it has had high value in our detectors; once we reviewed that IOC and adjusted it's weight in the static analysis algorithm, everything was fixed (regarding high false-positive rate). However, we still have few hashes to fix verdict on (such as few of those you shared).

I reviewed all the samples and they were flipped due to overly aggressive IOC weight.

Re: Firewall intercepts Virus between networks. False Positive???

Indorama_Ventures — Thu, 07 Jun 2018 07:04:58 GMT

Leo,

We noticed that an upgrade was available of PDQ inventory. After the upgrade (release 3) the virus detections disappeared.

I have also informed PDQ/Admin Arsenal about our findings.

Remko

Re: Firewall intercepts Virus between networks. False Positive???

Leo_Dittemore — Thu, 07 Jun 2018 21:08:41 GMT

I asked the PDQ team to update their application. The firewall team also also tells me that a signature update released yesterday corrected this. No alerts so far today.

Thanks,

leo